origin_not_allowed
The message text is shown in the example below.
| HTTP status | 403 |
type | permission_error |
| Retry? | No, not unchanged |
| Status | In the public catalog (error-envelope.ts) |
| Extra fields | none |
When it happens
The key has an origin allowlist and the request’s Origin header is missing or not on it.
Example
{
"error": {
"type": "permission_error",
"code": "origin_not_allowed",
"message": "This API key is not allowed to be used from this origin.",
"param": null,
"request_id": "req_6f1c2a9e0b7d4c3a8e5f1b2d"
}
}How to fix it
- Add the exact origin (scheme, host and port) to the key’s allowlist in the Console.
- Server-side calls send no
Origin; use a key without an allowlist for them.
Detect it in code
err = resp.json().get("error", {})
if resp.status_code == 403 and err.get("code") == "origin_not_allowed":
log.warning("%s (%s)", err["message"], err["request_id"]) # fix the request; do not retry unchangedRelated
Was this page helpful?